Ps – Log Analytics

Il est possible de taper sur un Log Analytics en faisant une requête PowerShell (depuis un Azure Automation par exemple).
Cela nécessite le rôle Storage Blob Data Contributor sur le Log Analytics

Connect-AzAccount -Identity
Set-AzContext -Subscription "sub-xxx"
$workspaceName = "log-shd-xxx"
$workspaceRG = "rg-shd-xxx"
$WorkspaceID = (Get-AzOperationalInsightsWorkspace -Name $workspaceName -ResourceGroupName $workspaceRG).CustomerID

$query = "SigninLogs
| where ResourceTenantId != $tenantId
| where AADTenantId == $tenantId
| where ResultSignature == 'SUCCESS'"

$kqlQuery = Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceID -Query $query